fix(graphql): lowercase status/role enum + OTP test mock

[tedtadesse]

Fixes the CI manage.py test run (3 failures + 1 error). Two unrelated issues.

1. Booking status / user role serialized UPPERCASE (3 failures)

graphene-django 3.2.3 auto-converts a CharField(choices=…) into a GraphQL Enum, whose values serialize as the UPPERCASE name — so status returned "PENDING"/"APPROVED"/"CANCELLED" instead of the lowercase DB value the tests assert:

AssertionError: 'PENDING' != 'pending'   (createBooking.booking.status)
AssertionError: 'APPROVED' != 'approved' (updateBookingStatus)
AssertionError: 'CANCELLED' != 'cancelled' (cancelBooking)

Set convert_choices_to_enum = False on BookingType and UserType to return the raw lowercase values. This restores the lowercase contract that both the test suite and the mobile client depend on (the Flutter client parses lowercase status and role — User.role had the same latent bug, fixed here proactively).

Verified safe: no test asserts the uppercase form, and status/role are only ever passed as quoted string arguments (never enum literals), so query inputs are unaffected.

2. OTP test starved Django's salt RNG (1 error)

OtpModelTests patched accounts.models.secrets.choice with a 6-value side_effect. Because secrets is a shared module, the patch also intercepted make_password()'s salt generation, which drained the iterator → RuntimeError: generator raised StopIteration (PEP 479 / Python 3.12).

The mock now only fixes the OTP digit alphabet and delegates any other alphabet (the salt) to the real RNG.

Verification

Backend Python can't run in my local env, so changes are syntax-verified (py_compile) and reasoned against the suite (grep confirms no uppercase/enum-input dependencies). Please let CI run the suite to confirm green.

🤖 Generated with Claude Code